Set-AzureADKerberosServer : Failed to connect to domain error

Question

Hi all,

I try to create the Kerberos Server object for a FIDO scenario in Hybrid AzureAD (described here: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key-on-premises#create-kerberos-server-object.

I run (as Enterprise Admin) the Set-AzureADKerberosServer on an AADC server in a root domain, the Kerberos object should be created in a child domain from the root. Error shows up:

Set-AzureADKerberosServer : Failed to connect to domain: childdomain.example.com

The AADC has the usual open ports to this child domain like LDAP/Kerberos/RPC High Ports etc. .... are there other specific network requirements for this commandlet?

Thx,
Philipp

Answer 1

Hello @Philipp Foeckeler ,

Thanks for reaching out.

Could you please try using respective child-domain's Domain Administrator username and password in which the value of the sAMAccountName attribute is unique instead enterprise Admin from root domain. Please let us know behavior because I think this possibly related to https://learn.microsoft.com/en-us/troubleshoot/azure/active-directory/user-name-pwd-incorrect#resolution

Hope this helps.

------
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello sikumars-msft, many thanks for helping.

unfortunately, I got the same error when I tried a domain admin from the subdomain (with a unique sAMAccountName). As I run these commands on the AADC server (which runs on the forest root domain), does it make sense to copy the module files to a server in this subdomain and run the command there? Or does it need to be on the AADC ?

Thank you and kind regards,
Philipp